Potential fix for pull request finding 'CodeQL / Reflected server-side cross-site scripting'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: mrunankpawar

samples/app_oidc_mfa_sample_app.py

@@ -29,7 +29,7 @@
 
 import os
 
-from flask import Flask, redirect, request, session
+from flask import Flask, escape, redirect, request, session
 
 from descope import AuthException, DescopeClient
 
@@ -99,7 +99,9 @@ def callback():
     error = request.args.get("error")
 
     if error:
-        return f"MFA failed: {error} - {request.args.get('error_description', '')}", 401
+        safe_error = escape(error)
+        safe_error_description = escape(request.args.get("error_description", ""))
+        return f"MFA failed: {safe_error} - {safe_error_description}", 401
     if not code or state != session.get("expected_state"):
         return "Invalid or missing callback params", 400